Grants 
programme 


Grants programme 


Applicants’ guide 
2021/2022 


Page 1 of 13 


Introduction by Elizabeth Denham 


A key aspect of the ICO’s regulatory approach is an awareness that we do 
not have all the answers. Modern data protection is complex and fast 
moving. It increasingly overlaps with and raises societal and economic 
questions, reflecting the huge impact data-driven innovation has on all of 
our lives. 


That is why my office actively seeks the wisdom and promotes the work 
of others. Throughout my time as Commissioner, I have prioritised 
building stakeholder relationships to improve our understanding of our 
regulatory space, by working with organisations, other regulators, and 
data protection authorities in other jurisdictions. 


When I launched our grants programme in 2017, it was to encourage 
research and privacy innovation in significant areas of data protection 
risk. From the start, my office had a clear vision of a well-funded scheme 
that could have a genuine impact on the UK information rights 
environment and improve public trust in how personal data is used. I also 
wanted to see the programme giving a greater voice to some of the 
expertise and creative thinking I had seen in the UK’s academic and not- 
for-profit communities. 


As we launch the next phase of the programme, I would reflect it has 
already successfully met those objectives. 


We supported research that showed children’s views that social media 
accounts should be automatically wiped when they reach 18, and helped 
develop a prototype software tool for capturing patient privacy 
preferences for their health and social care data. We also supported the 
creation of an online tool demonstrating the relatively few data points 
needed to reidentify apparently pseudonymised data sets. 


The second phase included a project developing a training programme for 
researchers working with public sector data, and a team conducting a 
study of smart homes to develop new approaches to privacy design. We 
also funded research into the impact of data protection law on the use of 
pseudonymised genomic data in healthcare, and a project that supported 
the data rights of people experiencing homelessness. 


In the most recent phase of our programme, we supported projects that 
facilitated transparency around AI, big data and machine learning, as well 
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as on research that supports children’s rights, in line with our Age 
Appropriate Design Code. The projects we funded looked at smart homes, 
adtech and biometric technologies. 


This fourth year’s objectives seek to increase the public’s trust and 
confidence in how their data is used. Our focus reflects the broad impact 
of data-driven innovation, as well as the dramatic societal changes and 
acceleration of uptake of technology over the past year. 


We are seeking to fund projects linked to surveillance technologies, the 
‘datafication’ of homeworking, digital identity and data sharing. We are 
also again interested in research that supports children’s rights. 


In the past four years we have focused on support for projects that 
enable innovation and assure responsible data use. The days when data 
protection regulation was seen as a blocker to innovative business have 
long passed. Our sandbox programme continues to work alongside 
innovative projects, and sits neatly alongside the research funded by our 
grants programme. And across the ICO, our advice and support 
encourage innovation while protecting people’s information rights. 


I committed the ICO to the grants programme until 2021, and our work 
this year includes reviewing and reporting on its progress. My term as 
Information Commissioner ends this year, and so that report will inform 
the decision of my successor on the future of the project. 


This guide provides a wealth of information of how we can support you. I 
hope it encourages you to get involved, and to be part of the solution to 
the challenging questions modern data protection asks. 


Elizabeth Denham 
Information Commissioner 
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What is this guide? 


This guide provides applicants with details of the ICO grants programme 
and explains how to apply for funding. It also sets out our expectations, 
should your application be successful. The detailed terms and conditions 
of the programme are set out in the Grant Agreement that each grant 
recipient signs once a proposal is approved. 


What is the grants programme? 


The ICO introduced the grants programme to promote good practice. The 
programme also supports independent, innovative research and solutions 
focused on privacy and data protection issues. The grants programme 


supports the delivery of the ICO Information Rights Strategic Plan 2017- 
2021. Our Head of Innovation oversees the grants programme. 


If interested, eligible organisations bid for grants to facilitate independent 
research and projects. The minimum award is £20,000 and the maximum 
award is £100,000. 


An explanation of who is eligible is set out below. 


When is the grants programme open for applications? 


The grants programme opens for applications on 28 January 2021. 


We first launched the programme in June 2017. We aim to open the call 
for proposals at least once a year. We may choose to open or close the 
application window based on the success of previous rounds. This is the 
final round of the programme in its current form. 


What are the grants programme’s objectives? 


The grants programme’s objectives are to: 


e support and encourage research and privacy-enhancing solutions in 
significant areas of data protection risk; 

e focus on projects that will make a real difference to the UK public; 

e increase awareness of privacy-enhancing solutions with data 
controllers across the UK; 
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e improve understanding of how individuals view privacy issues, 
interactions with new technologies and promote better public 
awareness; 

e promote uptake and application of research results by relevant 
stakeholders, including policy makers; and 

e develop existing privacy research capacity in academic and not-for- 
profit sectors. 


What are the research themes for 2021/2022? 


We set six strategic goals in our Information Rights Strategic Plan: 


1. To increase the public’s trust and confidence in how data is used 
and made available. 

2. Improve standards of information rights practice through clear, 
inspiring and targeted engagement and influence. 

3. Maintain and develop influence within the global information rights 
regulatory community. 

4. Stay relevant, provide excellent public service and keep abreast of 
evolving technology. 

5. Enforce the laws we help shape and oversee. 


6. To be an effective and knowledgeable regulator for cyber related 
privacy issues. 


The ICO is inviting applications for projects that meet one or more of the 
strategic goals set out in our Information Rights Strategic Plan. In 
particular, we are seeking proposals that align with goals one, two and 
four. 


The grants programme also supports the aims of the National Data 
Strategy in enabling organisations to appropriately use personal data to 
innovate, experiment and realise the value of their data across public and 
private sectors. 


Therefore, this year we are seeking privacy-by-design or accountability 
solutions which focus on key privacy challenges or the privacy 
implications of new technologies. Please note that we are looking for 
applications of clear public benefit with outputs that are open source 
and re-usable. Examples of areas of interest include: 


e Surveillance technologies: for example, the ethical and 
accountable use of emerging biometric technologies in the private 
and public sectors or the long term impacts on public attitudes to 
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surveillance, monitoring and tracking as a result of the COVID-19 
pandemic. 

e ‘Datafication’ of homeworking: research and tools related to 
issues of tracking, transparency and collection of personal or special 
category data of home workers. 

e Digital identity: for example health passports, including issues of 
transparency, accountability, inclusiveness, data sharing and 
accuracy. 

e Data sharing, smart cities, artificial intelligence and big 
data: in particular, research that promotes privacy-by-design and 
innovation in emerging public and private uses or research and 
tools to support post-end of transition global connectivity for SMEs. 

e Data protection issues and solutions for vulnerable adults, 
groups at risk of inequality and children: for example, research 
and tools supporting the ICO’s Age Appropriate Design Code 
(Children’s Code) and approaches to age assurance and verification 
mechanisms. 


Examples of other challenges are contained in the plans or in recent 
guidance of policy documents on the ICO website. 


Proposals do not need to be technology-based. However, proposals must 
have practical application and provide real-world solutions that are of 
clear public benefit to the UK. 


What are the Functional Grant Standards? 


The grants programme is ran in line with our obligations as a public body 
to account for our expenditure and value for money. We conduct the 
grants programme in accordance with the UK government’s Functional 
Grant Standards. These are the standards required when allocating public 
funds to grants schemes. You can find further details on the requirements 
at Grants Standards - GOV.UK. 


Who is eligible to apply? 


In order to tap into the broadest range of expertise in this area, the 
scheme is open to both UK and international organisations. All proposals 
must meet the objectives set out above, including the ability to deliver for 
UK individuals and organisations. We will not consider proposals that seek 
to find a solution to data protection or privacy risks that do not impact on 
the UK. 
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The minimum award is £20,000 and the maximum award is £100,000. 
Eligible applicants (whether lead or joint) can include: 


e academic institutions; 

e organisations with a genuine commitment to public benefit 
outcomes; 

e trade and industry associations; or 

e civil society groups. 


Those who would not be eligible include: 


political parties and organisations; 

religious groups and organisations; 

current or former ICO employees; 

any individual who has been disqualified as a director in accordance 

with the Company Directors Disqualification Act 1986; 

e any organisation or individual subject to insolvency or bankruptcy 
proceedings, including voluntary arrangements with creditors; or 

e any organisation that has been the subject of an enforcement 

notice, monetary penalty notice or legal proceedings by the ICO 

Enforcement Department. 


The lead applicant has full responsibility for undertaking the project, and 
must provide their contact details on the application form. 


Unless there are exceptional circumstances, no more than one award is 
made to any applicant in each funding round. 


How long should the research project last? 


We expect all research proposals to conclude within the grant period set 
out in your grant agreement. This will normally be 12 months from the 
date of the first payment of funds. If you expect your project will run for 
longer than 12 months, you must make this clear in your application and 
set out clearly why it cannot conclude within this time. In exceptional 
circumstances, grants may extend beyond 12 months with our prior 
written approval. 


What other costs will the ICO cover? 
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The ICO will provide assistance with funding costs directly incurred by 
applicants in conducting and completing the proposed project. Such costs 
include: 


salaries for members of the project team; 

administrative, survey and publication costs; 

other costs including travel (reasonable costs only); and 

minor equipment, such as IT equipment and software necessary to 
complete the research project. 


Any other costs are subject to prior approval by the ICO. 
We do not fund: 


e membership of professional organisations or journal subscription 

fees; 

fellowships or PhD studentships; 

rent, purchase of accommodation or any other capital costs; 

the cost of purchase or hire of any vehicles; 

equipment which is more than 25% of the total amount awarded; 

and 

e expenses incurred prior to or after completion of the funding period 
set out in the grant agreement. 


You must provide detailed information about the costs that you require 
funding and evidence confirming any funding or support received from 
elsewhere. All expenses must be reasonable and proportionate. 


We are not presently in a position to fund any proposals that may amount 
to state aid. If you are unsure whether your proposal could fall within this 
regime, you should refer to the State aid manual - GOV.UK for further 
guidance. 


What are the reporting requirements? 


If you are a successful grants recipient, you must submit a progress and 
expenditure report on at least a quarterly basis. Details of when this is 
due are set out in your grant agreement. We reserve the right to require 
you to attend a meeting to discuss any concerns we may have in relation 
to the successful completion of your project, at any time throughout the 
grant period. 


The final report and expenses schedule must be submitted to us within 
one month of the end of your research project. 
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Data protection 


All applicants must comply with the Data Protection Act 2018 and the UK 
General Data Protection Regulation 2016/679. Detailed guidance on what 
this means for you is available on our website. As a public authority we 
will, from time to time, be required to disclose information in accordance 
with the Freedom of Information Act 2000 and the Environmental 
Information Regulations. You may also need to disclose information to us 
to enable us to fulfil these obligations. Full details of how we use your 
information is available in our privacy policy. 


As part of our obligations to provide guidance and promote good practice, 
we may require certain information produced using funding from this 
grants programme to be made available to the public under open licence. 
This includes the Open Government Licence and any other similar 
mechanisms in existence, such as the Creative Commons platforms. 


Do we need safeguarding policies in place? 


All applicants whose projects are likely to include children or vulnerable 
adults are expected to have robust safeguarding policies in place, 
including up-to-date criminal records checks where appropriate. 


How do we apply? 


You must submit your ICO Grants Programme application form and 


supporting evidence via email to icograntsprogramme@ico.org.uk by the 


closing date and time set out in this guide. The closing date is 5pm on 11 
March 2021. 


You must answer all questions on the application form in full and attach 
any supporting evidence to your application form. 


You need to submit a summary of your proposal with your application 
form. Please limit your summary to 500 words. 


We need full contact details for your organisation and contact details for 
the lead applicant. 


You must provide information to confirm the legal status of your 


organisation, including any registered charity or company registration 
numbers. 
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We need documents for both lead and joint applicants, including 
governance documents, annual accounts and privacy policies. Without 
these, the review panel cannot consider your application. 


The application process is as follows: 


Initial sift of applications to determine those that meet the eligibility 
criteria. We notify in writing the unsuccessful applicants at this 
stage. 

First review - internal review of applications meeting the eligibility 
criteria. Initial recommendations for funding. 

Second review - internal and external peer review panel. Final 
recommendations for funding. 

Final decision by Information Commissioner or Deputy 
Commissioner. 

We notify in writing the successful applicants. 


How does the ICO assess applications? 


Assessment of applications is made against the following criteria: 


Overall quality - the proposal has good overall quality and 
demonstrates a high standard of knowledge and understanding of 
relevant issues. 

Relevance and timeliness — the proposal is relevant to our 
Information Rights Strategic Plan and there are no potential 
conflicts with our remit and values. 

Feasibility - the proposal is accurate, with a sound methodology 
and has realistic budgets and timelines. 

Value for money -the proposal offers an effective, economical and 
high quality solution. This would also include the ability of the 
project to link with other independent sources of public funding, eg 
match funding. 

Outcomes and benefits - the proposal sets out clear expectations 
for a positive impact on UK data protection rights and obligations. 
There is clear evidence of a plan to disseminate research results to 
enable uptake by relevant end-users. It explains short and long 
term outcomes. 


You should demonstrate how you meet each of these criteria in your 
application and summary proposal. 


You must include: 


a detailed methodology; 
project deliverables and outcomes; and 
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e key milestones and timescales. 


We also require details of any groups or stakeholders that you intend to 
interview or survey and how you intend to do this. 


What are the key dates? 


Please submit applications by email to icograntsprogramme@ico.org.uk. 


The deadline for receipt of applications is 5pm on 11 March 2021. 
Please ensure you attach all additional documents to your application 
form. We cannot consider applications received after this time or 
incomplete applications. 


The first review takes place within eight weeks of the application 
deadline and the second review takes place within the following four 
weeks. 


All applicants are told the outcome of their application within four 
weeks of the second review. 


How are the funds paid? 


We limit the funds available to the amount set out in your application. We 
cannot provide any additional funding without prior written authorisation 
and any additional funds are subject to the grants programme budget 
limitations. The total funding provided to each project is not likely to be 
more than £100,000. On occasion, however, more funding may be 
available for exceptional proposals, subject to budgetary demands. 


Payments are made in respect of expenses and costs incurred directly as 
a result of your research. You need to submit an expenses report, 
attaching all relevant receipts, on at least a quarterly basis. 


Following receipt of the signed grant agreement, payment of funds is 
made by BACS into the lead applicant’s bank account. We reserve the 
right to carry out checks on the information provided, which may include 
credit checks, prior to transferring any funds to successful applicants. 


We pay up to 75% of the total grant at the start of the project. We pay 
the remaining 25% on submission of a satisfactory final report and final 
expenses report. Surplus funds must be returned to us and we retain any 
remaining funds that we have not already paid to you. 


Page 12 of 13 


We reserve the right to withdraw funding and recover any funds already 
paid to you if you make any false representations in relation to your 
application or project. 


Are we required to acknowledge the ICO’s funding? 


Yes. You need to acknowledge the support of the ICO in facilitating your 
project. You must acknowledge our support in all publications and media 
communications, including press releases, presentations and training 
courses. A specific ICO grants programme logo is available for use. The 
Commissioner (or an employee of the ICO) is given the opportunity to 
participate in public announcements related to the research project. 


Evaluation 


We expect successful applicants to participate in any evaluation exercise 
the ICO carries out to assess the impact and value of the grants 
programme. 


You must be willing and able to participate in events we organise to 
promote the grants programme and the outcomes of your project. 
Examples of participation include presenting research outcomes at our 
conferences and speaking events, writing articles for our newsletters and 
other promotional activities. 


Can I have help with my application? 


Yes. If you require any assistance in completing your application, please 


contact us at icograntsprogramme@ico.org.uk and we can assist with any 


queries around the application process. We provide written feedback on 
your application if you are unsuccessful at any stage. 


Please also let us know if you require any reasonable adjustments to 
facilitate your application. 


How do I complain about the grants programme? 


If you are unhappy about the way we handle your application, we ask that 
you contact us in the first instance to discuss your concerns. If we are 
unable to resolve the situation, you may make a formal complaint to us. 
Please refer to the Complain about us section of our website. 


Please note we are unable to accept appeals against our decision on your 
application. 
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